News & Sicurezza

CVE ID :CVE-2025-40948 Published : May 12, 2026, 10:16 a.m. | 14 minutes ago Description :A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions Severity: 6.8 | MEDIUM Visit the link for more details, such as CVSS details, affected products, timeline, and more...

A vulnerability has been identified in blueplanet 100 NX3 M8 (All versions), blueplanet 100 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 105 TL3 (All versions), blueplanet 105 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 110 TL3 (All versions), blueplanet 125 NX3 M11 (All versions), blueplanet 125 TL3 (All versions), blueplanet 125 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 137 TL3 (All versions), blueplanet 150 TL3 (All versions), blueplanet 150 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 155 TL3 (All versions), blueplanet 155 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 165 TL3 (All versions), blueplanet 165 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 25.0 NX3-33.0 NX3 (All versions), blueplanet 3.0 NX3-20.0 NX3 (All versions), blueplanet 3.0 TL3-60.0 TL3 (All versions), blueplanet 3.0-5.0 NX1 (All versions), blueplanet 360 NX3 M6 (All versions), blueplanet 50.0 NX3-60.0 NX3 (All versions), blueplanet 87.0 TL3 (All versions), blueplanet 87.0 TL3 GEN2 (All versions < V6.1.4.9), blueplanet 92.0 TL3 (All versions), blueplanet 92.0 TL3 GEN2 (All versions < V6.1.4.9), blueplanet gridsafe 110 TL3-S (All versions < V3.91), blueplanet gridsafe 137 TL3-S (All versions < V3.91), blueplanet gridsafe 92.0 TL3-S (All versions < V3.91), blueplanet hybrid 10.0 TL3 (All versions), blueplanet hybrid 6.0 NH3-12.0 NH3 (All versions). A CRC16-based algorithm for generating Technical Service credentials could allow an attacker to derive the credentials from the devices serial number and misuse them to gain unauthorized access.

The affected devices contain a null pointer dereference vulnerability while processing specially crafted IPv4 requests. This could allow an attacker to cause denial of service condition. A manual restart is required to recover the system.

The LifePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'n' parameter of the lp_update_mds AJAX action in all versions up to, and including, 2.2.2. This is due to the `wp_ajax_nopriv_lp_update_mds` action being registered without nonce verification or capability checks, combined with insufficient input sanitization and output escaping when the series name is rendered in the admin settings page. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.4.17 due to insufficient escaping on user supplied parameters and lack of sufficient preparation on the existing SQL query in the getListForTbl() function. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. NOTE: This issue is partially mitigated by a patch in version 1.4.11 that adds a nonce check for a nonce that is only available to administrators.

Critical 9.8 Alert: Hard-Coded Credentials in Dell ECS and ObjectScale Leave Filesystems Exposed Dell has released a high-priority security update addressing multiple vulnerabilities within its Elastic Cloud Storage (ECS) and ObjectScale platforms. The advisory highlights a series of flaws that c ... Read more Published Date: May 12, 2026 (16 hours, 40 minutes ago) Vulnerabilities has been mentioned in this article.

Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages TeamPCP, the threat actor behind the recent supply chain attack spree, has been linked to the compromise of the npm and PyPI packages from TanStack, UiPath, Mistral AI, OpenSearch, and Guardrails AI a ... Read more Published Date: May 12, 2026 (16 hours, 50 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-45321 CVE-2026-23918

Critical PHP SOAP Extension Vulnerabilities Enables Remote Code Execution Attacks A serious cluster of vulnerabilities has been uncovered in PHP’s core string processing and ext-soap components, putting numerous web servers at immediate risk of total takeover. While the SOAP extens ... Read more Published Date: May 12, 2026 (17 hours, 6 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-6104 CVE-2026-7262 CVE-2026-7261 CVE-2026-7258 CVE-2026-6722

3500 Wazuh-servers missen update voor kritiek path traversal-lek Wereldwijd zijn er meer dan 3500 Wazuh-servers, waaronder 76 in Nederland, die een beveiligingsupdate voor een kritiek path traversal-lek missen, waardoor aanvallers in het ergste geval volledige cont ... Read more Published Date: May 12, 2026 (17 hours, 13 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-30893

CVE ID :CVE-2026-35227 Published : May 12, 2026, 8:16 a.m. | 14 minutes ago Description :An unauthenticated remote attacker may exhaust all available TCP connections in the CODESYS Modbus TCP Server stack if a race condition in connection handling is successfully exploited, preventing legitimate clients from establishing new connections. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...

Critical 9.6 Severity: SAP May 2026 Patch Day Fixes Dangerous S/4HANA and Commerce Cloud Flaws Today, SAP released its monthly security patch update, addressing 15 new security notes. This month’s patch day is particularly significant due to the presence of two Critical vulnerabilities, both ca ... Read more Published Date: May 12, 2026 (17 hours, 32 minutes ago) Vulnerabilities has been mentioned in this article.

CVE ID :CVE-2026-39432 Published : May 12, 2026, 7:49 a.m. | 41 minutes ago Description :Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.53. Severity: 8.2 | HIGH Visit the link for more details, such as CVSS details, affected products, timeline, and more...